CVE-2023-46351-mib (#235)

_posts/2024-01-18-mib.md

@@ -0,0 +1,91 @@
+---
+layout: post
+title: "[CVE-2023-46351] Improper neutralization of SQL parameter in My Presta's modules : mib for PrestaShop"
+categories: modules
+author:
+- TouchWeb.fr
+- 202 Ecommerce
+- Friends-Of-Presta.org
+meta: "CVE,PrestaShop,mib"
+severity: "critical (9.8)"
+---
+
+In the module mib from MyPresta.eu for PrestaShop, a guest can perform SQL injection in affected versions.
+
+
+## Summary
+
+* **CVE ID**: [CVE-2023-46351](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-46351)
+* **Published at**: 2024-01-18
+* **Platform**: PrestaShop
+* **Product**: mib
+* **Impacted release**: <= 1.6.0 (1.6.1 fixed the vulnerability)
+* **Product author**: MyPresta.eu
+* **Weakness**: [CWE-89](https://cwe.mitre.org/data/definitions/89.html)
+* **Severity**: critical (9.8)
+
+## Description
+
+
+The methods `mib::getManufacturersByCategory()` has sensitive SQL calls that can be executed with a trivial http call and exploited to forge a SQL injection.
+
+There is a prerequisite to exploit this vulnerability : "Activate categories filter" configuration must be set to enable which is not the default configuration.
+
+This exploit uses a specific payload and most attackers can conceal the payload during the exploit, so you will never know within your conventional frontend logs that it exploits this vulnerability. **You will only see "POST /" inside your conventional frontend logs.** Activating the AuditEngine of mod_security (or similar) is the only way to get data to confirm this exploit.
+
+
+## CVSS base metrics
+
+* **Attack vector**: network
+* **Attack complexity**: low
+* **Privilege required**: none
+* **User interaction**: none
+* **Scope**: unchanged
+* **Confidentiality**: high
+* **Integrity**: high
+* **Availability**: high
+
+**Vector string**: [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H](https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?vector=AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
+
+## Possible malicious usage
+
+* Obtain admin access
+* Remove data from the associated PrestaShop
+* Copy/paste data from sensitive tables to FRONT to expose tokens and unlock admins's ajax scripts
+* Rewrite SMTP settings to hijack emails
+
+
+## Patch from 1.5.6
+
+```diff
+--- 1.5.6/modules/mib/mib.php
++++ 1.6.1/modules/mib/mib.php
+...
+            'WHERE 1 ' .
+-           ('AND cp.`id_category` ='. $category) . ' ' .
++           ('AND cp.`id_category` ='. (int) $category) . ' ' .
+            ($active ? 'AND m.`active` = 1 ' : '') .
+...
+```
+
+## Other recommendations
+
+* It’s recommended to upgrade to the latest version of the module **mib**.
+* Upgrade PrestaShop to the latest version to disable multiquery executions (separated by “;”) - be warned that this functionality **WILL NOT** protect your SHOP against injection SQL which uses the UNION clause to steal data.
+* Change the default database prefix `ps_` with a new longer, arbitrary prefix. Nevertheless, be warned that this is useless against blackhats with DBA senior skill because of a design vulnerability in DBMS
+* Activate OWASP 942's rules on your WAF (Web application firewall), be warned that you will probably break your backoffice and you will need to pre-configure some bypasses against this set of rules.
+
+## Timeline
+
+| Date | Action |
+|--|--|
+| 2023-09-21 | Issue discovered during a code review by [TouchWeb.fr](https://www.touchweb.fr) |
+| 2023-09-21 | Contact Author |
+| 2023-10-19 | Request a CVE ID |
+| 2023-10-23 | Received CVE ID |
+| 2024-01-18 | Publish this security advisory |
+
+## Links
+
+* [Author product page](https://mypresta.eu/modules/front-office-features/manufacturers-brands-images-block.html)
+* [National Vulnerability Database](https://nvd.nist.gov/vuln/detail/CVE-2023-46351)